The RedTeamDaily API

Security news, CVEs and the companies and threat actors in them, as JSON. Our own summaries, CISA KEV and exploited data, and a link to every original article.

Getting started

1. Sign in (or use your Teams team), then open its API keys page.
2. Create a key and choose what it can read. Copy it: it is shown once.
3. Call the API from your server:

curl -H "Authorization: Bearer $RTD_API_KEY" \
  "https://api.redteamdaily.com/public/v1/stories?severity=critical&limit=5"

Authentication

Send your key in the Authorization header as Bearer rtd_live_…. Never put it in a web address: we refuse keys in query strings, because addresses end up in logs. Keys are for servers. The API sends no CORS headers, so browsers on other sites can’t call it with your key. If a key leaks, rotate it on the API keys page: the old one stops at once.

Each key has scopes: read:stories (stories and search), read:cves and read:entities. A call outside its scopes gets 403 missing_scope.

Endpoints

Base address: https://api.redteamdaily.com/public/v1. JSON only. Lists are newest first, paged with nextCursor: pass it back as cursor until it is null. Responses carry an ETag; send it as If-None-Match and an unchanged answer is an empty 304 (it still counts as a request).

Examples

JavaScript (Node 18 or later)

const res = await fetch("https://api.redteamdaily.com/public/v1/cves?exploited=true&limit=10", {
  headers: { Authorization: `Bearer ${process.env.RTD_API_KEY}` },
});
if (res.status === 429) console.log("wait", res.headers.get("retry-after"), "seconds");
const { data, nextCursor, attribution } = await res.json();

Python

import os, requests
r = requests.get("https://api.redteamdaily.com/public/v1/stories",
                 params={"region": "gb", "since": "2026-11-01"},
                 headers={"Authorization": f"Bearer {os.environ['RTD_API_KEY']}"},
                 timeout=20)
r.raise_for_status()
for story in r.json()["data"]:
    print(story["headline"], story["url"])

A story looks like this:

{
  "attribution": "RedTeamDaily",
  "data": {
    "id": "6fca896c-…", "url": "https://redteamdaily.com/story/…",
    "headline": "…", "summary": "…", "summarySimple": "…", "summaryExpert": "…",
    "severity": "critical", "category": "vulnerability", "cves": ["CVE-2026-…"],
    "sourceCount": 3, "publishedAt": "2026-11-02T08:15:00.000Z",
    "entities": [{ "id": "…", "type": "company", "name": "…", "url": "…" }],
    "sources": [{ "outlet": "…", "url": "https://…", "publishedAt": "…" }]
  }
}

Plans and rate limits

Limits are per key. Every answer has RateLimit-Limit, RateLimit-Remaining, RateLimit-Reset (seconds until midnight UK time, when daily counts reset) and RateLimit-Policy headers. Over a limit you get 429 with Retry-After: wait that long. Prices are per organisation, before any VAT, billed monthly by Stripe; cancel any time.

Content and attribution

• We return our own headlines, summaries, categories and CVE data, and links to the original articles (the outlet’s name, the address and the date). We never return publishers’ article text or their titles.
• Every response has "attribution": "RedTeamDaily". Where you show our summaries, show “Source: RedTeamDaily” with a link to the story’s url.
• Send readers to the original articles through the sources links for the full reporting.
• Summaries are written by AI from several sources and checked automatically; see how we use AI.

The full terms: API terms of use.

OpenAPI

Every endpoint and field is described in an OpenAPI 3.1 file: download openapi.json.